CrowdStrike does this trick where it replaces the file (being transferred over a network socket) with zeroes if it matches the malware signature. Assuming that these are the malware signature files themselves, a match wouldn't be surprising.

This actually makes the most sense, and would help explain how the error didn't occur during testing (in good faith, I assume it was tested).

In testing, the dev may have worked from their primary to deploy the update to a series of secondary drives, then sequential performed a test boot from each secondary drive configured for each supported OS version. A shortcut/quick way to test that would've bypassed how their product updates in customer environments, also bypassing checks their software may have performed (in this case, overwriting their own file's contents).

CrowStrike foot gunning itself would be amusing, if expected.

Far and away the most entertaining of the possible root causes.

Ah thanks. I've made the title questionable now.

Finally confirmed by CrowdStrike themselves:

https://www.crowdstrike.com/blog/tech-analysis-channel-file-...